CVE-2026-48618: Node.js TLS Auth Bypass Vulnerability

CVE-2026-48618 Overview

CVE-2026-48618 is a TLS hostname verification flaw in Node.js caused by inconsistent Unicode dot separator handling between the resolver and the certificate verifier. The mismatch in hostname normalization allows an attacker to bypass wildcard-depth authentication checks in TLS certificates. Successful exploitation compromises the confidentiality guarantees of TLS connections and undermines the intended security boundary between hostnames. The issue affects all supported release lines, including Node.js 22, Node.js 24, and Node.js 26. It is tracked under CWE-176: Improper Handling of Unicode Encoding.

Critical Impact

An authenticated network attacker can bypass TLS wildcard hostname verification, enabling impersonation of hosts outside the certificate's intended scope and disclosure of confidential traffic.

Affected Products

• Node.js 22 (including 22.22.3)
• Node.js 24 (including 24.16.0)
• Node.js 26 (including 26.3.0)

Discovery Timeline

• 2026-06-26 - CVE-2026-48618 published to NVD
• 2026-06-26 - Last updated in NVD database
• June 2026 - Node.js publishes security release addressing the flaw

Technical Details for CVE-2026-48618

Vulnerability Analysis

The vulnerability stems from a normalization mismatch between two components in the Node.js TLS stack. The DNS resolver and the certificate hostname verifier treat Unicode dot separators differently when parsing hostnames. Unicode characters such as U+3002 (ideographic full stop), U+FF0E (fullwidth full stop), and U+FF61 (halfwidth ideographic full stop) are canonicalized to ASCII dots in some code paths but treated as ordinary label characters in others.

This inconsistency alters the perceived depth of a hostname label structure. A certificate carrying a wildcard entry such as *.example.com may be accepted by the verifier for a hostname that the resolver ultimately treats as belonging to a different domain hierarchy. The result is a wildcard-depth authentication bypass in which certificate scope is expanded beyond what the issuing authority intended.

Root Cause

The root cause is improper handling of Unicode encoding [CWE-176]. Hostname normalization is not applied consistently across the resolver and the TLS verifier, producing divergent interpretations of the same input. This class of issue commonly appears when IDNA (Internationalized Domain Names in Applications) processing is not uniformly enforced.

Attack Vector

An attacker with the ability to influence hostnames used in TLS connections, or to present a wildcard certificate they legitimately control, can craft inputs containing Unicode dot lookalikes. The verifier accepts the certificate as matching, while the resolver directs traffic to a host outside the certificate's intended domain scope. The attack requires network positioning and low privileges to influence the connection target.

No verified public exploit code is available. Refer to the Node.js June 2026 Security Releases for authoritative technical details.

Detection Methods for CVE-2026-48618

Indicators of Compromise

• TLS connections initiated by Node.js processes to hostnames containing non-ASCII dot separators such as U+3002, U+FF0E, or U+FF61.
• Unexpected certificate acceptance for wildcard entries where the matched hostname contains Unicode characters in label separators.
• Outbound TLS sessions to punycode-encoded (xn--) hostnames that were not present in application configuration.

Detection Strategies

• Inspect application logs for hostnames passed to tls.connect(), https.request(), or checkServerIdentity() containing non-ASCII code points in separator positions.
• Correlate DNS query logs with the hostnames observed in TLS Server Name Indication (SNI) fields to identify normalization divergence.
• Deploy an EDR or XDR platform capable of monitoring child process arguments and network destinations initiated by node binaries.

Monitoring Recommendations

• Enable Node.js runtime logging for TLS handshake events and record the presented Subject Alternative Name (SAN) entries.
• Alert on any Node.js version in production matching 22.22.3, 24.16.0, or 26.3.0 and earlier vulnerable builds.
• Monitor egress TLS traffic for certificates whose wildcard SAN entries match hostnames containing internationalized labels.

How to Mitigate CVE-2026-48618

Immediate Actions Required

• Upgrade to the fixed Node.js releases published in the June 2026 security release cycle for the 22.x, 24.x, and 26.x lines.
• Inventory all runtime environments, container images, and Lambda-style functions using vulnerable Node.js versions.
• Restrict outbound TLS connections from Node.js services to an allowlist of expected destinations where feasible.

Patch Information

Node.js has released patched builds addressing the hostname normalization mismatch. Consult the Node.js Security Release Blog for the exact fixed versions across the 22.x, 24.x, and 26.x release lines and apply them across all production and development environments.

Workarounds

• Implement a custom checkServerIdentity callback that rejects hostnames containing non-ASCII dot separators before delegating to the default verifier.
• Pre-normalize all hostnames to ASCII form using IDNA (url.domainToASCII()) before passing them to TLS APIs.
• Pin TLS certificates for critical outbound connections to eliminate reliance on wildcard SAN matching until patches are deployed.

# Configuration example: enforce ASCII-only hostnames before TLS use
node -e "const url=require('url'); const h=process.argv[1]; if(h!==url.domainToASCII(h)){process.exit(1)}" "$TARGET_HOST"